AI is incredibly helpful when used as a tool out of many for software development. Audit, review, refactoring, chore, documentation, prototyping, comparison, testing… endless possibilities.
Yet, at the same time, when left unchecked or used without proper knowledge, it is incredibly dangerous.
Why? Just as humans, AI makes mistakes. Royal messups at times, just as bad as human devs brainfarts. However, it is often different kinds of mistakes, which if done right can be leveraged in a great way:
An AI might find bugs in your decades old code in seconds while you have gone over it hundreds of times without realizing. Often, because another bug was hiding it from you.
At the same an experienced developer will often look at an AI generated code snippet and, within seconds, will be able to tell that it should not / cannot or must not be used that way for some reason.
When the Obsidian Team decided to implement auto-approval for community plugins, they pulled the stop and I fear this might even break the community in two ways.
Why? Because they implemented a workflow that only works for “conventional” coding and allowed it to be (ab)used by vibe coding.
For a conventinal plugin (coded by a seasoned dev) this new workflow is amazing. It helps the devs with fixing low hanging fruits and adhere to conventions (or - if they don’t care - the score card indicates that to the user)
For a vibe-coded plugin (code generated by AI) this new workflow falls flat. If I had to compare, it is like a dev would be allowed to review and approve their own plugin.
I said it might break in two ways:
conventional plugins cannot compete with this.
- They already have a hard time competing with the speed of vibe-coding while maintaining stability / maturity. Now, that workflow puts even more pressure by handing free passes to thousands of low quality solutions.
- Watching core members / contributors of this community struggle to keep up or find the motivation to do so is disheartening to see.
it makes using plugins for users as dangerous as never before.
- You have plugins out there that destroy user’s notes or vaults and nobody has ever even looked at the code.
- I mean this quite literally. The code might be 100% auto-generated and the plugin auto-approved. Meaning, by the time the user downloads and uses the plugin, in an extreme case they might literally be the first human to use it.
This is not about “just always make backups” (which you should). Or “there is already a general warning when enabling plugins” (which is fine).
It is about what users are allowed to expect when installing plugins.
At the very least, in my opinion, there should be a policy enforced by Obsidian Staff requesting devs to disclose the usage of AI.
And if that scope means that the code itself is auto-generated, there should be a required label added to that plugin like “The code for this plugin is auto-generated. It will not / cannot be manually audited by the Obsidian Staff. Only use this if you understand the risks. Do not use in production. Disable Auto-Updating.”
This does not prevent devs from publishing vibe-coded plugins as conventional (might even just be ignorance or naivity with no ill intend), but having a policy in place would allow the Obsidian Team to immediately deal (ban / quarantine / whatever) with it on a low effort basis, which - I am convinced - is necessary to keep the plugin environment healthy / working.
I’ll give you an example of a plugin that should not exist to illustrate the problem. I was involved in dealing with the data loss so it’s an example I verified myself.
I am, however, not interested in pointing it out just for a resolution of “oh, let’s just ban it”. That does not solve the root problem.
I’m interested to hear if the Obsidian Team acknowleges this as a problem or if this is how the plugin repo is supposed to work.
And I am interested to hear if I missed any efforts within the community to tackle this on their own. Like currated lists without outdated/broken versions or lists with tested/acknowledged vibe-coded plugins or something like that.
Example:
Problem:
- The plugin always passes the auto-approval
- On usage, it unintentionally deleted data from your notes
- On usage, it unintentionally changed your frontmatter style
- The repository does not mention any usage of AI.
- When asked, the repo owner confirmed in an issue that:
- The whole repository is maintained by AI
- The whole code is written by AI and has never been touched by the “dev”
- The repo owner is convinced that the community or plugin users do not have any legitimate interest in being made aware of any of that.
So while it is correct, that the repo owner can do as it pleases them (unless they are violating GitHubs terms and conditions or others legal rights), I think the community (both, devs and plugin users) is in desparate need of measures to safeguard itself from being exposed / harmed in that way (be it either by wasting time on contributing or loosing data or similar).
This is not a rant. You are invited to point out any flaws.
I genuinely try to contribute to improve the current state of the plugin repo.